Cisco ASA Unified Communications Guide

Decryption and Inspection of Unified Communications Encrypted Signaling

With encrypted voice inspection, the security appliance decrypts, inspects and modifies (as needed, for example, performing NAT), and re-encrypts voice signaling traffic while all of the existing VoIP inspection functions for SIP are preserved. Once voice signaling is decrypted, the plain text signaling message is passed to the existing inspection engines.

The security appliance acts as a TLS proxy between the Cisco IP Phone and Cisco UCM. The proxy is transparent for the voice calls between the phone and the Cisco UCM. Cisco IP Phones download a Certificate Trust List from the Cisco UCM before registration which contains identities (certificates) of the devices that the phone should trust, such as TFTP servers and Cisco UCM servers. To support server proxy, the CTL file must contain the certificate that the security appliance creates for the Cisco UCMs. To proxy calls on behalf of the Cisco IP Phone, the security appliance presents a certificate that the Cisco UCM can verify, which is a Local Dynamic Certificate for the phone, issued by the certificate authority on the security appliance.

TLS proxy is supported by the Cisco Unified CallManager Release 5.1 and later. You should be familiar with the security features of the Cisco UCM. For background and detailed description of Cisco UCM security, see the Cisco Unified CallManager documentation.

Supported Cisco UCM and IP Phones for the TLS Proxy

Cisco Unified Communications Manager

The following releases of the Cisco Unified Communications Manager are supported with the TLS proxy:

• Cisco Unified CallManager Version 5.1
• Cisco Unified Communications Manager 6.1
• Cisco Unified Communications Manager 7.0
• Cisco Unified Communications Manager 8.0
• Cisco Unified Communications Manager 8.6
• Cisco Unified Communications Manager 10.5

Cisco Unified IP Phones

The following IP phones are supported with the TLS proxy:

• Cisco Unified IP Phone 7985
• Cisco Unified IP Phone 7975
• Cisco Unified IP Phone 7971
• Cisco Unified IP Phone 7970
• Cisco Unified IP Phone 7965
• Cisco Unified IP Phone 7962
• Cisco Unified IP Phone 7961
• Cisco Unified IP Phone 7961G-GE
• Cisco Unified IP Phone 7960
• Cisco Unified IP Phone 7945
• Cisco Unified IP Phone 7942
• Cisco Unified IP Phone 7941
• Cisco Unified IP Phone 7941G-GE
• Cisco Unified IP Phone 7940
• Cisco Unified Wireless IP Phone 7921
• Cisco Unified Wireless IP Phone 7925
• Cisco Unified IP Conference Phone 8831
• Cisco IP Communicator (CIPC) for softphones

Incorporating the Firewall into the Unified Communications System

Configuring the ASA is not enough to fully incorporate the firewall into the Cisco Unified Communications system. You must also add the ASA to the Certificate Trust List (CTL) using the Cisco Certificate Trust List Client, which is part of the Unified Communications Manager.

When you configure a firewall in the CTL file, you can secure a Cisco ASA firewall as part of a secure Cisco Unified Communications Manager system. The Cisco CTL Client displays the firewall certificate as a “CCM” certificate.

When configured correctly, the ASA receives the CTL file from the CTL provider. However, the ASA does not store the raw CTL file in the flash, rather, it parses the CTL file and installs the appropriate trustpoints.

For detailed information on how to add the ASA as a firewall to the Unified Communications Manager system, look for information on the CTL Client Setup in the Security Guide for Cisco Unified Communications Manager for the software version you are using. You can find the documents at http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-callmanager/products-maintenance-guides-list.html.

Also see the Security Guide for information on installing, exporting, and creating UCM-side certificates. You will need to import the ASA certificate into UCM.

Create the Proxy Trustpoint for the Unified Call Manager Cluster

The Cisco UCM proxy certificate could be self-signed or issued by a third-party CA. The certificate is exported to the CTL client. The following procedure shows how to create a self-signed proxy.

The ASA uses this proxy when authenticating with the phones. The ASA acts as the server in place of the Call Manager.

Procedure

Step 1 Create the RSA keypair for the trustpoint.

crypto key generate rsa label key-pair-label modulus size

Cisco UCM releases 10.5.2su3 and earlier allow a maximum key of 1024 bits. The default is 2048, so you need to include the modulus keyword.

Example

Step 2 Create the proxy trustpoint for the Unified Call Manager cluster.

crypto ca trustpoint trustpoint_name

You enter trustpoint configuration mode, where you can configure the trustpoint characteristics.

Example

Step 3 Generate a self-signed certificate.

enrollment self

Example

Step 4 Do not to include a fully qualified domain name (FQDN) in the Subject Alternative Name extension of the certificate during enrollment.

fqdn none

Example

Step 5 Specify a subject DN in the certificate during enrollment.

subject-name X.500_name

Cisco IP Phones require certain fields from the X.509v3 certificate to be present to validate the certificate by consulting the CTL file. Consequently, the subject-name entry must be configured for a proxy certificate trustpoint. The subject name must be composed of the ordered concatenation of the CN, OU and O fields. The CN field is mandatory; the others are optional.

If you use multiple attributes, separate them with a semicolon. Use one of the following forms:

• CN=xxx;OU=yyy;O=zzz
• CN=xxx;OU=yyy
• CN=xxx;O=zzz
• CN=xxx

Example

Step 6 Specify the key pair you created for the trustpoint.

keypair keyname

Example

Step 7 Enroll the trustpoint.

crypto ca enroll trustpoint_name

Example

Create the Internal Local CA to Sign Local Dynamic Certificates for Phones

Create an internal local CA to sign the LDC for Cisco IP Phones. This local CA is a regular self-signed trustpoint with proxy-ldc-issuer enabled. The ASA presents these certificates to the Call Manager server on behalf of the phones, securing the connection between the ASA and the Call Manager.

You can alternatively use the embedded local CA LOCAL-CA-SERVER on the ASA to issue the LDC, but this is not recommended.

Procedure

Step 1 Create the RSA keypair for the local CA.

crypto key generate rsa label key-pair-label modulus size

Cisco UCM releases 10.5.2su3 and earlier allow a maximum key of 1024 bits. The default is 2048, so you need to include the modulus keyword.

Example

Step 2 Create the proxy trustpoint for the local Certificate Authority (CA) for signing local dynamic certificates.

crypto ca trustpoint trustpoint_name

You enter trustpoint configuration mode, where you can configure the trustpoint characteristics.

Example

Step 3 Generate a self-signed certificate.

enrollment self

Example

Step 4 Define the CA as one that can issue local dynamic certificates (LDC).

proxy-ldc-issuer

You can configure this option for a local CA only if you also specify enrollment self.

The ASA generates a local dynamic certificate for each phone that registers with the Call Manager. When the phone unregisters, the dynamic certificate is automatically deleted. These certificates do not appear in the running configuration; they are created and destroyed as needed.

Example

Step 5 Add a fully qualified domain name (FQDN) in the Subject Alternative Name extension of the certificate during enrollment.

fqdn name

Example

Step 6 Specify a subject DN in the certificate during enrollment.

subject-name X.500_name

The CN field is mandatory; the others are optional. If you use multiple attributes, separate them with a semicolon. Use one of the following forms:

• CN=xxx;OU=yyy;O=zzz
• CN=xxx;OU=yyy
• CN=xxx;O=zzz
• CN=xxx

Example

Step 7 Specify the key pair you created for the local CA.

keypair keyname

Example

Step 8 Enroll the trustpoint.

crypto ca enroll trustpoint_name

Example

Create a CTL Provider

Create a CTL Provider in preparation for a connection from the CTL Client.

Procedure

Step 1 Create the Certificate Trust List (CTL) provider.

ctl-provider ctl_name

You enter CTL provider configuration mode, where you can configure the provider characteristics.

Example

Step 2 Specify the addresses of the CTL clients that should be able to connect with the CTL provider on the ASA.

client interface if_name ipv4_address

Where if_name is the interface through which the client can be reached, and the IPv4 address is the address of the workstation on which the CTL client is installed. Enter this command as many times as needed to identify all CTL clients that you want to allow.

Example

Step 3 Specify the username and password for client authentication.

client username name password password [ encrypted ]

The username and password must be the username and password for Cisco UCM administration. Specify the optional encrypted keyword if the password is encrypted (in which case it must be 16 characters).

Example

Step 4 Export the proxy trustpoint you created for the Cisco UCM server to the CTL client.

export certificate trustpoint_name

The certificate will be added to the Certificate Trust List file composed by the CTL client and subsequently distributed to all the phones that download the CTL file. Specify the name of the trustpoint you created in Create the Proxy Trustpoint for the Unified Call Manager Cluster. This ensures that each phone has the server certificate the ASA uses to authenticate the connection.

Example

Step 5 If necessary, change the port on which the CTL provider listens.

service port number

The default port number listened to by the CTL Provider is TCP 2444, which is the default CTL port on the Cisco UCM. If you changed this port in the Cisco UCM, you must specify the port on this command so that the CTL Provider can communicate with the CTL client. The port must be in the range 2000-9999.

Example

Step 6 Enable the CTL provider to parse the CTL file from the CTL client and install trustpoints for entries from the CTL file.

ctl install

Trustpoints installed by this command have names prefixed with “_internal_CTL_<ctl_name>.”

Example

Create the TLS Proxy

Create the TLS proxy to handle the encrypted signaling.

Procedure

Step 1 Create the RSA keypair for the local CA.

crypto key generate rsa label key-pair-label modulus size

Cisco UCM releases 10.5.2su3 and earlier allow a maximum key of 1024 bits. The default is 2048, so you need to include the modulus keyword.

Example

Step 2 Create the TLS proxy.

tls-proxy name

You enter TLS proxy configuration mode, where you can configure the proxy characteristics.

Example

Step 3 Specify the proxy trustpoint certificate to present during the TLS handshake with phone clients.

server trust-point proxy_trustpoint

Specify the name of the trustpoint you created in Create the Proxy Trustpoint for the Unified Call Manager Cluster.

The server command configures the proxy parameters for the original TLS server. In other words, the parameters for the ASA to act as the server during a TLS handshake the TLS clients.

Example

Step 4 Specify the local CA trustpoint to provide the local dynamic certificates.

client ldc issuer ca_trustpoint_name

Specify the name of the local CA you created in Create the Internal Local CA to Sign Local Dynamic Certificates for Phones. This trustpoint must include the proxy-ldc-issuer command or be the default local CA server (LOCAL-CA-SERVER).

Example

Step 5 Specify the key pair you created for the local dynamic certificates.

client ldc key-pair keyname

Example

Step 6 (Optional.) Configure the cipher suite to use when the proxy acts as a client to the Cisco UCM.

client cipher-suite cipher_suite

For client proxy (the proxy acts as a TLS client to the server), the user-defined cipher suite replaces the default cipher suite, or the one defined by the ssl encryption command. You can use this command to achieve difference ciphers between the two TLS sessions. You should use AES ciphers with the CallManager server. Separate multiple options with spaces.

Example

Step 7 (Optional.) Configure the cipher suite to use when the proxy acts as a server to the phones.

If you do not define the ciphers the TLS proxy can use, the proxy server uses the global cipher suite defined by the ssl cipher command. By default, the global cipher level is medium, which means all ciphers are available except for NULL-SHA, DES-CBC-SHA, and RC4-MD5. Specify the server cipher-suite command only if you want to use a different suite than the one generally available on the ASA. Separate multiple options with spaces.

To set the minimum TLS version for all SSL server connections on the ASA, see the ssl server-version command. The default is TLS v1.0.

Example

Enable TLS Proxy for SIP Inspection

Configure the required service policies to enable encrypted voice inspection for SIP.

Because secure protocols use different ports than the regular unencrypted versions, you need to configure unique classes for TLS proxy inspection.

• Secure SIP (SIPS) uses TCP/UDP 5061 (rather than SIP’s 5060).

The inspection_default class filters on the unencrypted ports only.

The following procedure explains how to create these classes and add the TLS proxy inspections to the existing global_policy policy map. Alternatively, you can create service policies for specific interfaces.

For more detailed information on how to configure service policies, see the firewall configuration guide.

Before You Begin

You can configure inspection policy maps to customize the inspection. If you do not want to use the default settings for the inspections, configure the inspection policy maps before configuring the service policy. For details on customizing SIP, see the firewall configuration guide. The following procedure assumes you are using the default settings.

Procedure

Step 1 Create the class for secure SIP.

Because SIP endpoints can use TCP or UDP, you cannot create a simple port match for the class. Instead, create a service group for TCP/5061 and UDP/5061, then use that object in an ACL.

a. Create a service object group for TCP/UDP 5061.

b. Create an ACL that matches secure SIP traffic for all addresses.

c. Create the class map using an ACL match.

Step 2 Edit the global_policy policy map.

Step 3 Add the Secure SIP class and configure SIP inspection with the TLS proxy.

Step 4 Verify the global_policy policy map now has the expected content.

In the following output, you can see that the running configuration performs SIP inspection without the TLS proxy on the unencrypted default ports that match the inspection_default class. Then, the TLS proxy inspections appear for the correct sec_sip class for the encrypted ports.

Step 5 Enable the global_policy service policy to implement your changes.

Create the Proxy Trustpoint for the Unified Call Manager Cluster (ASDM)

The Cisco UCM proxy certificate could be self-signed or issued by a third-party CA. The certificate is exported to the CTL client. The following procedure shows how to create a self-signed proxy.

The ASA uses this proxy when authenticating with the phones. The ASA acts as the server in place of the Call Manager.

Procedure

Step 1 Choose Device Management > Certificate Management > Identity Certificates, then click the Add button.

Step 2 Enter a Trustpoint Name. For example, ccm_proxy.

Step 3 Choose Add a New Identity Certificate.

Step 4 For Key Pair, create a new key pair:

a. Click New.

b. Select RSA as the key type.

c. Select Enter New Key Pair Name, then enter a name. For example, ccm_proxy_key.

d. For Size, select 1024.

Cisco UCM releases 10.5.2su3 and earlier allow a maximum key of 1024 bits.

e. For Usage, select General Purpose.

f. Click Generate Now.

The key is generated and you are returned to the Add Identity Certificate dialog box with the new key automatically selected.

Step 5 For Certificate Subject DN, specify a subject DN.

Cisco IP Phones require certain fields from the X.509v3 certificate to be present to validate the certificate by consulting the CTL file. Consequently, you must configure a subject DN for a proxy certificate trustpoint. The subject name must be composed of the ordered concatenation of the CN, OU and O fields. The CN field is mandatory; the others are optional.

If you use multiple attributes, separate them with a semicolon. Use one of the following forms:

• CN=xxx;OU=yyy;O=zzz
• CN=xxx;OU=yyy
• CN=xxx;O=zzz
• CN=xxx

For example, cn=EJW-SV-1-Proxy.

Step 6 Choose Generate Self-Signed Certificate.

Note Do not select the Act as local certificate authority and issue dynamic certificates for TLS proxy option for this trustpoint.

Step 7 Click the Advanced button, and clear the FQDN field on the Certificate Parameters tab. Click OK.

Do not to include a fully qualified domain name (FQDN) in the Subject Alternative Name extension of the certificate during enrollment.

Step 8 Click Add Certificate.

Create the Internal Local CA to Sign Local Dynamic Certificates for Phones (ASDM)

Create an internal local CA to sign the LDC for Cisco IP Phones. This local CA is a regular self-signed trustpoint with the ability to issue local dynamic certificates. The ASA presents these certificates to the Call Manager server on behalf of the phones, securing the connection between the ASA and the Call Manager.

You can alternatively use the embedded local CA (LOCAL-CA-SERVER) on the ASA to issue the LDC, but this is not recommended.

Procedure

Step 1 Choose Device Management > Certificate Management > Identity Certificates, then click the Add button.

Step 2 Enter a Trustpoint Name. For example, ldc_server.

Step 3 Choose Add a New Identity Certificate.

Step 4 For Key Pair, create a new key pair:

a. Click New.

b. Select RSA as the key type.

c. Select Enter New Key Pair Name, then enter a name. For example, ldc_signer_key.

d. For Size, select 1024.

Cisco UCM releases 10.5.2su3 and earlier allow a maximum key of 1024 bits.

e. For Usage, select General Purpose.

f. Click Generate Now.

The key is generated and you are returned to the Add Identity Certificate dialog box with the new key automatically selected.

Step 5 For Certificate Subject DN, specify a subject DN.

The CN field is mandatory; the others are optional. If you use multiple attributes, separate them with a semicolon. Use one of the following forms:

• CN=xxx;OU=yyy;O=zzz
• CN=xxx;OU=yyy
• CN=xxx;O=zzz
• CN=xxx

For example, cn=FW_LDC_SIGNER_172_23_45_200.

Step 6 Choose Generate Self-Signed Certificate.

Step 7 Choose the Act as local certificate authority and issue dynamic certificates for TLS proxy option.

The ASA generates a local dynamic certificate for each phone that registers with the Call Manager. When the phone unregisters, the dynamic certificate is automatically deleted. These certificates do not appear in the running configuration; they are created and destroyed as needed.

Step 8 Click the Advanced button, and enter an fully-qualified domain name in the FQDN field on the Certificate Parameters tab. Click OK.

For example, my-ldc-ca.example.com.

Step 9 Click Add Certificate.

Create a CTL Provider (ASDM)

Create a CTL Provider in preparation for a connection from the CTL Client.

Procedure

Step 1 Select Configuration > Firewall > Unified Communications > CTL Provider.

Step 2 Click Add to create a new provider, or select a provider and click Edit.

Step 3 Enter a CTL Provider Name. For example, my_ctl.

Step 4 In Certificate to be Exported, select the proxy trustpoint you created for the Cisco UCM server to the CTL client.

The certificate will be added to the Certificate Trust List file composed by the CTL client and subsequently distributed to all the phones that download the CTL file. Specify the name of the trustpoint you created in Create the Proxy Trustpoint for the Unified Call Manager Cluster (ASDM). This ensures that each phone has the server certificate the ASA uses to authenticate the connection.

For example, select ccm_proxy.

Step 5 Specify the addresses of the CTL clients that should be able to connect with the CTL provider on the ASA.

For each client, select the interface through which the client can be reached, and then enter the IPv4 address of the workstation on which the CTL client is installed. Click Add>> to add it to the list of clients. For example, inside 172.23.45.1.

Repeat the process as many times as needed to identify all CTL clients that you want to allow.

Step 6 Click More Options, and specify the username and password for client authentication.

The username and password must be the username and password for Cisco UCM administration. For example, CCMAdministrator, password XXXXXX.

Step 7 If necessary, change the port on which the CTL provider listens in the Port Number field.

The default port number listened to by the CTL Provider is TCP 2444, which is the default CTL port on the Cisco UCM. If you changed this port in the Cisco UCM, you must specify the port on this command so that the CTL Provider can communicate with the CTL client. The port must be in the range 2000-9999.

Step 8 Ensure that the Parse the CTL File Provided by the CTL Client and Install Trustpoints option is selected.

The system installs trustpoints for entries from the CTL file. Trustpoints installed from the file have names prefixed with “_internal_CTL_<ctl_name>.” If you disable this option, you must manually import and install each Call Manager server and CAPF certificate.

Step 9 Click OK.

Create the TLS Proxy (ASDM)

Create the TLS proxy to handle the encrypted signaling. The following procedure explains how to configure the proxy for encrypted SIP inspection.

Procedure

Step 1 Select Configuration > Firewall > Unified Communications > TLS Proxy.

Step 2 (Optional) Set the maximum number of TLS proxy sessions to be supported by the security appliance.

The default and maximum differ by device model. The Maximum TLS Sessions option controls the memory size reserved for cryptographic applications such as TLS proxy. Crypto memory is reserved at the time of system boot. If you increase the number, you must reboot the system to reserve the additional memory.

To change the default, select Specify the Maximum Number of TLS Proxy Sessions that the ASA Needs to Support, and enter the maximum number of sessions. These fields are below the table of TLS proxies.

Step 3 Click Add to create a new TLS proxy, or select a proxy and click Edit.

When you create a new proxy, you are taken through a wizard to configure the required properties. When editing an existing proxy, the wizard steps are presented as separate tabs. The following steps assume you are adding a new proxy.

Step 4 Enter a name for the proxy in TLS Proxy Name. For example, my_proxy. Click Next.

Step 5 Configure the options to use when the ASA acts as the TLS server for the phone clients.

For encrypted SIP inspection as explained in this procedure, the ASA acts as a proxy for Cisco Unified Call Manager. However, you could also configure the proxy for a Cisco Unified Presence Server (CUPS), or when configuring MMP inspection for a Cisco Unified Mobility Advantage (CUMA) server.

a. In Server Proxy Certificate, select the trustpoint you created in Create the Proxy Trustpoint for the Unified Call Manager Cluster (ASDM). For example, ccm_proxy.

The server proxy configures the proxy parameters for the original TLS server. In other words, the parameters for the ASA to act as the server during a TLS handshake the TLS clients.

If you have not already created the identity certificate, you can click Manage to add it.

b. (Optional.) You can define the security algorithms (ciphers) that the server can use by moving them from the available algorithms to the active algorithms list. If you do not specify ciphers, the default system ciphers are used. You can move the algorithms up or down to change their relative priority.

c. (Optional.) Click Install TLS Server’s Certificate to install the Call Manager certificate. Because this certificate will be installed from the CTL file, you do not need to install it. However, if you are not installing trustpoints from the CTL file, obtain the certificate from the Call Manager server and install it now.

d. Select Enable client authentication during TLS Proxy handshake. You would deselect this option only for testing purposes, or for MMP inspection.

For MMP inspection, used for Unified Mobility Advantage (CUMA), the client is not able to present a certificate, so authentication is not possible.

e. Click Next.

Step 6 Configure the options to use when the ASA acts as the TLS client for the original TLS server.

For encrypted SIP inspection as explained in this procedure, the ASA acts as a proxy for IP phones. However, you could also configure the proxy for a Microsoft LCS/OCS client for Cisco Unified Presence Federation, or when configuring MMP inspection for a Cisco Unified Mobility Advantage (CUMA) client.

a. Choose the Specify the Internal Certificate Authority to Sign the Local Dynamic Certificates for Phones.

The other options are used for other types of inspection:

• Configure the proxy client to use clear text to communicate with the remote TCP server. This option configures TLS offload for Diameter inspection, for use when the ASA is in the same data center as the Diameter server.
• Specify the proxy certificate for TLS Client. This option is for use when the client is also a server (in the case of Presence Federation), or when you want to use a single certificate to represent all clients (in Diameter inspection).

b. In Certificate, select the LDC issuer you created in Create the Internal Local CA to Sign Local Dynamic Certificates for Phones (ASDM). For example, ldc_server. This trustpoint must include the proxy-ldc-issuer command. If you have not created this trustpoint yet, click Manage and create it now.

Alternatively, if you want to use the default local CA server (LOCAL-CA-SERVER), select Certificate Authority Server.

c. For Key-Pair Name, click New and create a new RSA general purpose key pair, size 1024. (Cisco UCM releases 10.5.2su3 and earlier allow a maximum key of 1024 bits.) Give the key a new name, for example, phone_common. When you click Generate Now, the key is generated and you are returned to the wizard with the new key pair selected.

d. (Optional.) You can define the security algorithms (ciphers) to use when the proxy acts as a client to the Cisco UCM. Move the allowed ciphers from the available algorithms to the active algorithms list. These ciphers replace the original ones from the hello message. If you do not specify ciphers, the default system ciphers are used. You can move the algorithms up or down to change their relative priority. You can select the null cipher if you are confident communication with the Call Manager server is secure (for example, the server is in the same data center as the ASA).

e. Click Next.

Step 7 The final step of the wizard explains the additional steps you must perform. Click Finish.

Enable TLS Proxy for SIP Inspection (ASDM)

Configure the required service policies to enable encrypted voice inspection for SIP.

Because secure protocols use different ports than the regular unencrypted versions, you need to configure unique classes for TLS proxy inspection.

• Secure SIP (SIPS) uses TCP/UDP 5061 (rather than SIP’s 5060).

The inspection_default class filters on the unencrypted ports only.

The following procedure explains how to create these classes and add the TLS proxy inspections to the existing global_policy policy map. Alternatively, you can create service policies for specific interfaces.

For more detailed information on how to configure service policies, see the firewall configuration guide.

Before You Begin

You can configure inspection policy maps to customize the inspection. If you do not want to use the default settings for the inspections, configure the inspection policy maps before configuring the service policy. For details on customizing SIP, see the firewall configuration guide. The following procedure assumes you are using the default settings.

Procedure

Step 1 Choose Configuration > Firewall > Service Policy.

Step 2 Create the service policy for secure SIP.

a. Click Add > Add Service Policy Rule.

b. Select Global and click Next.

c. Choose Create a New Class and enter a class name, for example, sec_sip.

d. Choose Source and Destination IP Address (Uses ACL).

Because SIP endpoints can use TCP or UDP, you cannot create a simple port match for the class. Instead, create a service group for TCP/5061 and UDP/5061, then use that object in an ACL.

e. Click Next to define the ACL.

f. Select the following ACL options:

• Action = Match.
• Source = any
• Destination = any

g. For Destination Service, click the ... button to open the Browse Service dialog box.

h. Click Add > Service Group, and configure the following:

• Group Name = Something meaningful, such as sec_sip_ports.
• Select Create New Member, select tcp-udp for Service Type, enter 5061 for Destination Port/Range, then click Add>>.
• Click OK to save the object. This returns you to the Browse Service dialog box.

i. Double-click the object you just created to select it and click OK.

The Add Service Policy Rule - Traffic Match dialog box should now show your object selected in the Destination Service field for the ACL.

j. Click Next.

k. On the Rule Actions > Protocol Inspection tab, select SIP and click the associated Configure button.

l. Configure the following SIP inspection options:

• If you configured an inspection map to customize SIP inspection, choose Select a SIP Inspection Map, then select your map. Otherwise, leave Use the Default SIP Inspection Map selected.
• Select Enable Encrypted Traffic Inspection, then select the TLS proxy you configured for SIP inspection.

m. Click OK to save the SIP inspection options.

n. Click Finish to save the SIP inspection service policy.

Step 3 Click Apply to write the new policies to the device.